Cloudflare plans to become a public certificate authority and start production issuance of post-quantum Merkle Tree Certificates in the first quarter of 2027. Teams planning a post-quantum migration now have an issuer-side date to test web PKI against.
Perspective Coverage
4 publishers
- Builder
- Builder 45%
- Operator
- Operator 45%
- Investor
- Investor 10%
Reality
- Evidence50
- Adoption8
- Hype gap+30
- Incentives
- Insufficient
- Confidence60
Hacktron reports that GPT-5.6 Sol Ultra built a complete Chrome/V8 exploit chain in a controlled test for $1,596.89 of model compute. The benchmark handed the model the source tree and the public security-fix commits, so the figure covers only the compute for one lab task.
Publishers:hacktron.ai · runtimewire.com Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+45
- Incentives70
- Confidence55
Lightpanda shipped 1.0 of its open-source browser on October 2nd, passing 1,739,845 web-platform subtests without rendering pages. One encoding suite makes up about two-thirds of that count, so teams should judge it by whether their jobs need to see the page.
Reality
- Evidence45
- Adoption35
- Hype gap+25
- Incentives60
- Confidence50
Shopify added WebMCP checkout tools on September 28 that update payment and place an order once the buyer confirms. The spec is still a draft with no Firefox or Safari implementation, so tools belong on the open session behind a review step.
Reality
- Evidence50
- Adoption30
- Hype gap+5
- Incentives
- Insufficient
- Confidence45
Google's Android 17 Intrusion Logging syncs encrypted security and network logs to its servers and bars anyone from deleting them for a rolling 12 months. The feature is a separate opt-in, so the record exists only for people who enable it before an attack.
Reality
- Evidence58
- Adoption
- Insufficient
- Hype gap+10
- Incentives40
- Confidence60
CSS text-box-trim crops a headline's box to the font's cap height and baseline, replacing negative margins like -0.18em tuned by eye in devtools. The browser takes the numbers from the font file, so swapping the typeface or raising line-height no longer means retuning a margin.
Reality
- Evidence50
- Adoption60
- Hype gap+10
- Incentives
- Insufficient
- Confidence55
Any page calling Chrome's LanguageModel and Translator APIs can pull 2.8 GB into each isolated profile, a developer running a profile fleet found. Chrome's launch flags either expose the block to pages or stop security updates, so the team patched the engine.
Reality
- Evidence45
- Adoption15
- Hype gap+15
- Incentives50
- Confidence40
Chrome moves to a two-week release cycle on desktop, Android and iOS from version 153, according to a dev.to round-up of DevTools 151 to 153. Web teams get smaller milestones more often, each one another browser version to test against.
Reality
- Evidence40
- Adoption
- Insufficient
- Hype gap+15
- Incentives20
- Confidence40
VulnCheck counts Chrome CVEs up 563% and GitHub-issued CVEs up 476% this year, a rise it calls consistent with AI-assisted bug finding. Whether the volume lasts is unknown, so exploitation data still sets patch order.
Reality
- Evidence55
- Adoption45
- Hype gap+20
- Incentives55
- Confidence50
V8's 'is not valid JSON' error quotes the whole response body when it is 20 characters or fewer, according to a developer's tests on Node 24.13. A quote without a trailing ellipsis is the entire reply, so a short error body can be diagnosed from the logged message alone.
Reality
- Evidence62
- Adoption
- Insufficient
- Hype gap+5
- Incentives20
- Confidence58
Cloudflare has agreed to buy a GlobalSign root and applied to four browser root programs to become a public certificate authority. It has not issued a certificate yet, and its post-quantum certificates are aimed at Chrome's quantum-resistant root store in early 2027.
Reality
- Evidence55
- Adoption5
- Hype gap+20
- Incentives72
- Confidence60
Cloudflare plans to become a public certificate authority and issue post-quantum Merkle Tree Certificates from early 2027. Sites it fronts will manage both kinds from one system, so the planning work falls on old devices that will never add a new root.
Reality
- Evidence45
- Adoption5
- Hype gap+20
- Incentives55
- Confidence42
In Cloudflare's lab test, RFC 9842 dictionary compression sent a 272 KB JavaScript file as a 2.6 KB delta, where gzip produced 92.2 KB. Teams that deploy small fixes often can now send returning visitors the change, where today those visitors download the whole bundle again.
Reality
- Evidence50
- Adoption30
- Hype gap+25
- Incentives40
- Confidence55
Chrome 152 keeps google.com's cookies and storage after 'delete on close' is switched on, developer Jeff Johnson found. Google fixed a similar exemption in 2020, and the same behaviour in open-source Chromium means other browsers and test rigs need their own check.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence50
Google Search Console is rolling out a multimodal filter that counts searches started from an image, pooling Lens and three other entry points into one view. Teams can now size image-led discovery but cannot yet tell which of the four surfaces sent it.
Reality
- Evidence50
- Adoption
- Insufficient
- Hype gap0
- Incentives45
- Confidence55
Headless Chrome 149 wrote the same 1,345,909-byte PNG via canvas.toBlob at quality 0.1 and at 1.0, one developer's measurements show. A PNG export slider only changes the file if the tool downscales, quantises colours or switches to WebP or AVIF.
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+15
- Incentives30
- Confidence60
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
- Evidence60
- Adoption35
- Hype gap+10
- Incentives
- Insufficient
- Confidence60
SOCRadar says the toolkit needs administrative or code execution access first, then writes itself into Chrome and Edge profiles with integrity values the browser accepts and bridges to a native host binary that runs shell commands.
Reality
- Evidence58
- Adoption10
- Hype gap+12
- Incentives
- Insufficient
- Confidence55
CVE-2026-87491 gives a crafted web page code execution inside Chrome's sandbox. The fix only takes effect when the browser restarts, and long-running sessions carry that exposure until they do.
Perspective Coverage
5 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap0
- Incentives30
- Confidence70
Proofpoint says at least four China-linked espionage groups fired the same BlueMoon code at different victims during the four weeks a Chromium fix took to reach stable Chrome, and two more groups probably did too.
Perspective Coverage
9 publishers
- Builder
- Builder 31%
- Operator
- Operator 60%
- Investor
- Investor 9%
Reality
- Evidence80
- Adoption30
- Hype gap+10
- Incentives40
- Confidence76
Earlier coverage
- A reflected XSS on a US university site launched a three-CVE Chrome chain at NGOs
Security · September 14, 2026 · 2 publishers
- Weizman's BragJack hijacks five Chromium AI assistants from a single installed extension
Security · September 20, 2026 · 3 publishers
- Chrome 154's 11 critical fixes: seven in webpage-reachable graphics code, four use-after-free bugs elsewhere
Security · September 24, 2026 · 2 publishers
- Staying lazy until the sort cuts a chain's 80,000-object peak to about 2,000
Build · September 23, 2026 · 1 publisher
- pdfium's text page drops the 0 Tz line that pypdf still returns
Build · September 23, 2026 · 1 publisher
- OpenAI's __obi cookie follows ChatGPT users onto advertiser pages for a year
Security · September 23, 2026 · 1 publisher
- A third Chinese APT ran the same Chrome and Windows zero-day chain from spoofed news sites
Security · September 21, 2026 · 3 publishers
- Capturing a Meet tab under MV3 mutes the call until you wire the stream back to output
Build · September 22, 2026 · 1 publisher
- Half the features Google showed on Googlebook need a paired Android phone
Product · September 21, 2026 · 1 publisher
- Google opens the Googlebook line at $900 across five laptop makers
Product · September 21, 2026 · 1 publisher
- Googlebook OS opens Gmail and Calendar as web wrappers from the Play Store
Product · September 21, 2026 · 1 publisher
- Google shipped Gmail on Googlebook OS as a Play Store web wrapper
Product · September 21, 2026 · 1 publisher
- The screen eyedropper you write in canvas stops at the edge of your own page
Build · September 20, 2026 · 1 publisher
- Chrome drops the extension the moment the native host logs to stdout
Build · September 19, 2026 · 1 publisher
- The selected candidate pair decides whether you are debugging coturn at all
Build · September 19, 2026 · 1 publisher
- Dashlane's new beta blocks the login form until the employee signs into the vault
Product · September 19, 2026 · 1 publisher
- Microsoft's record 974 patches are one month inside a year that has logged 66,401 CVEs
Product · September 19, 2026 · 1 publisher
- A scraper cleared Akamai Bot Manager by attaching to an ordinary Chrome over CDP
Build · September 19, 2026 · 1 publisher
- A Pion v4 SFU needs the SSRC rewritten before RTCP goes back upstream
Build · September 19, 2026 · 1 publisher
- Microsoft rates a missing authentication check in Azure AI Foundry at CVSS 10.0
Security · September 18, 2026 · 1 publisher
- Cloning Chrome under a second bundle ID stops Playwright jobs from holding the human's window
Build · September 18, 2026 · 1 publisher
- Chrome's own resolver masked the dead router DNS that killed four unattended jobs
Build · September 17, 2026 · 1 publisher
- KREMLIN forges Chromium's Secure Preferences HMACs with keys already on the endpoint
Build · September 17, 2026 · 1 publisher
- A modal body's 70vh scroll container clips options a headless dropdown already rendered
Build · September 16, 2026 · 1 publisher
- KREMLIN forges the HMACs Chromium uses to prove a user approved an extension
Security · September 16, 2026 · 1 publisher
- One extension commanded the AI in five Chromium browsers by seizing the page each one trusts
Security · September 16, 2026 · 1 publisher
- KREMLIN installers forge Chrome's Secure Preferences HMACs to register a stealer extension
Security · September 15, 2026 · 1 publisher
- One npm alias replaces TypeScript's two-engine DOM library
Build · September 15, 2026 · 1 publisher
- DOM.setFileInputFiles returns success while the input still holds zero files
Build · September 15, 2026 · 1 publisher
- Espionage crews exploited a Chrome flaw that Chromium had already fixed in public source
Leadership · September 15, 2026 · 1 publisher
- A page behind Chrome's WebMCP flag registers three agent tools without an MCP server
Build · September 14, 2026 · 1 publisher
- A Lighthouse 100 certifies a five-metric average that stops at first interactivity
Build · September 13, 2026 · 1 publisher
- Chrome's canvas still returns a device-specific hash with no noise injection
Build · September 13, 2026 · 1 publisher
- Apple limits iOS 27's new Safari features to the iPhone 15 Pro and newer
Product · September 13, 2026 · 1 publisher
- Extended Stable now bundles four Chrome milestones into the same eight-week window
Product · September 8, 2026 · 3 publishers
- Node ignores the corporate root certificate that the browser on the same laptop trusts
Build · September 12, 2026 · 1 publisher
- Chrome adds V8's in-process sandbox to its bug bounty before calling it a strong boundary
Build · September 11, 2026 · 1 publisher
- REVSTEALER-linked module LockAppHost disables 18 Windows update and malware-removal mechanisms before mining
Security · September 7, 2026 · 1 publisher
- Probes hit a maintainer's webserver ten minutes after his fix PR went public
Build · September 11, 2026 · 1 publisher
- Roblox will let Chrome users start a game straight from a link by the end of 2026
Product · September 11, 2026 · 1 publisher